Copyright: Saturday, January 04, 2003 15:50:10


Provides a space for you to type a name for this policy. The name can only be changed if this policy was created during the current session.


Provides a space for you to view the object identifier value for this policy. The object identifier value cannot be changed once the policy is created, but it can be copied and used elsewhere.


Provides a space for you to type a name for this policy. The name can only be changed if this policy was created during the current session.


Provides a space for you to view the object identifier value for this policy. The object identifier value cannot be changed once the policy is created, but it can be copied and used elsewhere.


Lists the available issuance policies that can be added to the issuance policy signature requirements.


Specifies whether the selected policy is marked as critical. A critical policy must be applied to each issuance or the issuance will fail.


Specifies whether the subject can use its certificate to issue certificates to other certification authorities.


Specifies whether the selected policy is marked as critical. A critical policy must be applied to each issuance or the issuance will fail.


Specifies whether the private key associated with this certificate can be used to digitally sign data.


Specifies whether the private key associated with this certificate can provide nonrepudiation of data, assuring that the data has not been altered since the subject verified it. This option can be selected when the template's intended purpose is signature.


Specifies whether the certificate can use the associated private key can sign issued certificates. This option can be selected when the template's intended purpose is signature.


Specifies whether the certificate can use the associated private key can sign certificate revocation lists (CRLs). This option can be selected when the template's intended purpose is signature.


Specifies that the subject can use this certificate to establish a shared secret key with another subject by using a key establishment algorithm, such as Diffie-Hellman. The cryptographic service provider (CSP) must also support this algorithm for the certificate to function properly.


Specifies that the subject can use this certificate to establish a shared secret key with another subject by sending a key encrypted with a public-key algorithm, such as RSA. The cryptographic service provider (CSP) must also support this algorithm for the certificate to function properly.


Specifies whether the subject can use the key in this certificate to encrypt data as well as other keys or whether the key can only be used to encrypt other keys.


Specifies whether the selected policy is marked as critical. If selected and the policy is not applied to each issuance, the issuance fails.


Lists the policies currently applied to this extension.


Click to add an existing policy to the list of policies used by this extension or create a new policy by using its object identifier.


Click to remove the selected policy from the list of policies that are used by this extension.


Click to change the name of the selected policy.


Lists the issuance policies that are available on the certification authority.


Click to create a new issuance policy.


Lists the available certificate templates that can be added to the list of certificate templates that are superseded by this template. When a subject renews a certificate that is based on a superseded template, the subject automatically enrolls for a new certificate that is based on the new certificate template.


Click to display the details of the selected certificate template.


Lists the extensions that are currently applied to this certificate template.


Click to view details and add policies to or remove policies from this extension.


Provides a space for you to type the display name for the template.


Specifies the name of the template.


Provides a space for you to type the number of units for the certificate validity period.


Lists the available validity period types.


Provides a space for you to type the number of units for the certificate renewal period.


Lists the available renewal period types.


Specifies whether to publish certificates that are based on this template in Active Directory.


Specifies the version of the certification authority that can use the template.


Lists the available purposes for certificates that are based on this template. This value can be changed on version 2 templates.


Specifies whether the subject can export the private key. Exporting the private key provides backup for the subject, but may weaken security if not managed properly.


Lists the available cryptographic service providers (CSPs).


Lists the available purposes for certificates that are based on this template. This value can be changed on version 2 templates.


Specifies whether to store the private key on the issuing certification authority to allow key recovery options. The certification authority must be configured to support key recovery. This option is available when the certificate template’s purpose is set to Encryption or Signature and encryption.


Specifies whether the certificate allows symmetric encryption algorithms that are supported by the subject, whether the certification authority supports them or not. This option is available when the certificate template’s purpose is set to Encryption or Signature and encryption.


Lists the available symmetric encryption key sizes.


Specifies whether the subject can export the private key. Exporting the private key provides backup for the subject but may weaken security if not managed properly.


Specifies that the subject provides the subject name information in its request. Selecting this option prevents client autoenrollment for this template. If this option is selected without setting one or more issuance requirements, subject can request certificates that may allow them to impersonate other subjects.


Specifies that the certification authority builds the subject name from information in Active Directory. The certification authority does not use information supplied by the subject.


Specifies whether the subject name includes the subject’s e-mail name. This option requires the subject’s Active Directory information to include a properly formatted e-mail name. This is useful when configuring a template that issues certificates to users.


Specifies that the subject that requests a certificate must be a computer or other device, not a user.


Specifies that the subject that requests a certificate must be a user, not a computer or other device.


Lists the issuance policies that are used for issuing certificates based on this template. This option is only available if the policy type required in signature includes issuance policy.


Click to add one or more issuance policies to the issuance policy signature requirements.


Click to remove the selected issuance policy from the list.


Provides a space for you to type the number of authorized signatures that is required to issue a certificate.


Specifies that the subject requires a valid certificate to obtain a new certificate when re-enrolling. If the certificate is not valid (for example, revoked or expired), the subject cannot re-enroll.


Specifies that the same criteria for enrollment of a certificate applies to re-enrollment.


Specifies whether there is a minimum number of authorized signatures that is required to issue a certificate.


Specifies that the subject must provide the subject name information in its request.


Specifies that the certification authority builds the subject name from information in Active Directory. The certification authority does not use information supplied by the subject.


Lists the available name formats that can be incorporated into the subject name.


Lists the available name formats that can be incorporated into the subject name.


Specifies whether the subject name includes the subject’s e-mail name. This option requires the subject’s Active Directory information to include a properly formatted email name.


Specifies whether the alternate subject name includes the subject’s e-mail name. This option requires the subject’s Active Directory information to include a properly formatted e-mail name. This is useful when you configure a template that issues certificates to users.


Specifies whether the alternate subject name includes the subject’s Domain Name System (DNS) name. This is useful when you configure a template that issues certificates to computers.


Specifies whether the alternate subject name includes the subject’s user principal name. This is useful when you configure a template that issues certificates to users.


Specifies whether the alternate subject name includes the subject’s service principal name. This is useful when you configure a template that issues certificates to computers.


Lists the templates that are superseded by this template.


Click to add certificate templates to the superseded templates list.


Click to remove the selected certificate template from the superseded templates list.


Lists the object identifiers that are available on the certification authority.


Click to copy the object identifier of the selected object to the clipboard. You can then paste it into another application.


Specifies that Active Directory is queried whenever a subject re-enrolls for a certificate that is based on this template. If a valid duplicate certificate currently exists in Active Directory, the request is rejected. This option is only applicable to reenrollment performed by autoenrollment.


Specifies that all certificate requests that are based on this template are placed in Pending Requests for later issuance or denial.


Lists the available policy types that are required for the signature. This option is only available if the number of authorized signatures is one or more.


Lists the available application policies that can be chosen for this certificate request. This option is only available if the policy type required in the signature includes application policy.


Provides details about the selected extension type.


Provides a space for you to type the location of the certification practice statement (CPS). This location should be accessible by all subjects. It must be in the form of a uniform resource locator (URL) and include the http:// prefix.


Lists the certificate templates that can be added to this certification authority for issuance.


Displays the name of the selected certificate template.


Lists various settings that this certificate template includes in issued certificates.


Lists the enhanced key usages that this certificate template includes in issued certificates.


Specifies whether obtaining a new certificate deletes the subject’s expired or revoked certificates This option is available when the certificate template’s purpose is set to Signature or Signature and smartcard logon.


Specifies that the client will not need to perform any action to request or renew a certificate based on this certificate template, and that the client can use the associated private key without providing additional input.


Specifies that the client will be prompted to provide input during the certificate enrollment and renewal procedures. Once the certificate is obtained, the client can use the associated private key without providing additional input.


Specifies that the client will be prompted to provide input during the certificate enrollment and renewal procedures. Once the certificate is obtained, the client must provide additional input each time they use the associated private key.


Lists the cryptographic service providers (CSPs) that are available to the client and allows you to select CSPs to use for certificate requests. The CSP must be installed on the target certification authority to appear on this list.


Specifies that any cryptographic service provider (CSP) can be used by the client.


Specifies that only the selected cryptographic service providers (CSPs) can be used by the client.


Lists the cryptographic service providers (CSPs) that are available to the client and allows you to select CSPs to use for certificate requests. One or more CSPs can be selected. If no CSP is selected, the client may use any CSP. The CSP must be installed on the target certification authority to appear on this list.